Hiding Communication of Essential Services by System Call Proxy

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Security software, which is one of the essential services, is considered to be important due to an increase in attacks on computers. The essential services are provided by processes which sometimes involve file manipulation and communication. Also, the essential services can be a target of attacks and be disabled because they can be an obstacle to attackers. Attackers can speculate essential services by monitoring the behavior of the processes. To avoid such attacks on essential services, methods for hiding their behavior are proposed. The methods use a virtual machine (VM) monitor for making it difficult for attackers to identify essential services by hiding process information and file manipulation. However, communication information remains visible to attackers. To address this problem, this study proposes a method for hiding the communication of essential services by using a system call proxy. We assume that a process providing essential services (essential process) runs on a protection target VM and a proxy process runs on a proxy VM. In the proposed method, system calls in the communication invoked by the essential process are executed by the proxy process. The system calls invoked by the proxy process are not executed on the protection target VM; therefore, attackers cannot identify the communication of essential services by monitoring their communication. This paper presents the design, implementation, and evaluation of the proposed method.

Original languageEnglish
Title of host publicationProceedings - 2018 6th International Symposium on Computing and Networking, CANDAR 2018
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages47-56
Number of pages10
ISBN (Electronic)9781538691823
DOIs
Publication statusPublished - Dec 27 2018
Event6th International Symposium on Computing and Networking, CANDAR 2018 - Takayama, Japan
Duration: Nov 27 2018Nov 30 2018

Publication series

NameProceedings - 2018 6th International Symposium on Computing and Networking, CANDAR 2018

Conference

Conference6th International Symposium on Computing and Networking, CANDAR 2018
CountryJapan
CityTakayama
Period11/27/1811/30/18

Keywords

  • Attack Avoidance
  • Communication Hiding
  • Virtual Machine

ASJC Scopus subject areas

  • Hardware and Architecture
  • Computer Networks and Communications
  • Software
  • Safety, Risk, Reliability and Quality

Fingerprint Dive into the research topics of 'Hiding Communication of Essential Services by System Call Proxy'. Together they form a unique fingerprint.

  • Cite this

    Okuda, Y., Sato, M., & Taniguchi, H. (2018). Hiding Communication of Essential Services by System Call Proxy. In Proceedings - 2018 6th International Symposium on Computing and Networking, CANDAR 2018 (pp. 47-56). [8594743] (Proceedings - 2018 6th International Symposium on Computing and Networking, CANDAR 2018). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/CANDAR.2018.00014